TL;DR
Yes, a BIOS or UEFI infection can spread to other storage drives even without an operating system present. This happens because the malicious code resides in firmware and can directly access and modify connected devices during boot-up. Prevention focuses on secure boot, careful updates, and physical security.
Understanding the Risk
Traditional viruses need an OS to run. BIOS/UEFI malware is different. It infects the low-level firmware that starts your computer before the OS loads. This gives it a lot of power:
- Direct Hardware Access: The infected firmware can directly read and write to connected storage drives.
- OS Independent: It doesn’t need Windows, macOS, or Linux to operate.
- Persistence: It’s harder to remove than OS-level malware because it lives outside the OS.
If a BIOS/UEFI is compromised, it can infect other drives connected during boot, even if those drives are empty or contain different operating systems.
How Infection Spreads
- Initial Infection: The malware typically enters via a malicious update (e.g., fake BIOS updates downloaded from untrusted sources), compromised hardware, or through vulnerabilities in the UEFI implementation itself.
- Boot Process Access: During startup, the infected firmware scans for connected storage devices.
- Drive Modification: It can then write malicious code to the Master Boot Record (MBR), Volume Boot Record (VBR), or even directly modify partitions on those drives. This makes them infected too.
- Chain Reaction: When an infected drive is connected to another system and booted from, it can infect that system’s firmware as well.
Steps to Prevent BIOS/UEFI Infections
- Secure Boot: Enable Secure Boot in your UEFI settings. This helps ensure only trusted software loads during startup.
- Access your UEFI settings (usually by pressing Del, F2, F12, or Esc during boot – check your motherboard manual).
- Find the “Boot” section and enable “Secure Boot”.
- Careful Updates: Only download BIOS/UEFI updates from the official manufacturer’s website. Verify the authenticity of the update file (checksum verification).
- Download the correct update for your specific motherboard model.
- Check the manufacturer’s website for checksum values (SHA256, MD5). Compare these to the downloaded file.
certutil -hashfile filename.exe SHA256
- Physical Security: Prevent unauthorized access to your computer’s hardware. A compromised USB drive or external device could introduce malware.
- Antivirus/Anti-malware (Limited): While traditional antivirus can’t detect BIOS/UEFI malware directly, some advanced security suites include firmware scanning capabilities. Run regular scans.
- Disable Boot from External Media: Unless you specifically need it, disable booting from USB or other external media in your UEFI settings to prevent accidental infection.
Detecting a BIOS/UEFI Infection
Detection is difficult. Look for these signs:
- Unexpected Boot Behavior: Slow boot times, unusual error messages during startup.
- Hardware Changes: Unexplained changes to UEFI settings.
- System Instability: Frequent crashes or freezes.
Some security tools offer firmware scanning but are not always reliable.
Removing a BIOS/UEFI Infection
- Flashing the Firmware: The most effective solution is to re-flash (update) the BIOS/UEFI with a clean image from the manufacturer. Warning: This is risky and can brick your motherboard if done incorrectly!
- Professional Help: If you’re not comfortable flashing the firmware yourself, seek assistance from a qualified computer technician or security professional.